GPackage
Static task
static1
Behavioral task
behavioral1
Sample
9d91a195667a4adfb342c3acf41349bb0a84d1d5272fe7546e716bb2f6e89526.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9d91a195667a4adfb342c3acf41349bb0a84d1d5272fe7546e716bb2f6e89526.exe
Resource
win10v2004-20220812-en
General
-
Target
9d91a195667a4adfb342c3acf41349bb0a84d1d5272fe7546e716bb2f6e89526
-
Size
184KB
-
MD5
a10dba4e9959aa277918a2dc990908e0
-
SHA1
5e7810dba3245c50b24811a8f6b58f975d48a75e
-
SHA256
9d91a195667a4adfb342c3acf41349bb0a84d1d5272fe7546e716bb2f6e89526
-
SHA512
203770ff715aa0ef473d139597040a090595a2749042f717907683ea34cad8ede7e81efb21c096cd6223b46bf564e269ae9d9df8cb5069beaa71ba70a5456cdc
-
SSDEEP
3072:b/jmQdcqy76N3k2mZ8Sta81fdxFE5p1ozoI7h+aS1GQ:b/jm8cqy76c4m1skzo0naGQ
Malware Config
Signatures
Files
-
9d91a195667a4adfb342c3acf41349bb0a84d1d5272fe7546e716bb2f6e89526.exe windows x86
a00452665447483d94e00f3231af82bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
core
?GCRCTable@@3PAKA
?GMalloc@@3PAVFMalloc@@A
??DFString@@QBEPBGXZ
?GLogHook@@3PAVFOutputDevice@@A
?appSprintf@@YAHPAGPBGZZ
?SafeString@FName@@SAPBGW4EName@@@Z
?Logf@FOutputDevice@@QAAXW4EName@@PBGZZ
?appTimestamp@@YAPBGXZ
?GFileManager@@3PAVFFileManager@@A
?GNull@@3PAVFOutputDevice@@A
?appStrcat@@YAPAGPAGPBG@Z
?appPackage@@YAPBGXZ
?Parse@@YAHPBG0PAGH@Z
?appCmdLine@@YAPBGXZ
?appStrlen@@YAHPBG@Z
?appStrcpy@@YAPAGPAGPBG@Z
?appBaseDir@@YAPBGXZ
?SafeSuppressed@FName@@SAHW4EName@@@Z
?GIsCriticalError@@3HA
?Flush@FOutputDevice@@UAEXXZ
?appRequestExit@@YAXH@Z
?LocalizeError@@YAPBGPBDPBG1@Z
?GIsGuarded@@3HA
?appStrncat@@YAPAGPAGPBGH@Z
?appStrncpy@@YAPAGPAGPBGH@Z
?GErrorHist@@3PAGA
?StaticShutdownAfterError@UObject@@SAXXZ
?GLog@@3PAVFOutputDevice@@A
?GIsRunning@@3HA
?MapCheck_Add@FFeedbackContext@@UAEXHPAXPBG@Z
?MapCheck_Clear@FFeedbackContext@@UAEXXZ
?MapCheck_Hide@FFeedbackContext@@UAEXXZ
?MapCheck_ShowConditionally@FFeedbackContext@@UAEXXZ
?MapCheck_Show@FFeedbackContext@@UAEXXZ
?appUnwindf@@YAXPBGZZ
??1FString@@QAE@XZ
??DFName@@QBEPBGXZ
?ParseParam@@YAHPBG0@Z
?GIsEditor@@3HA
?GIsClient@@3HA
?appGetVarArgs@@YAHPAGHAAPBG@Z
?GIsSlowTask@@3HA
?appFailAssert@@YAXPBD0H@Z
?CalcHomeDir@FFileManager@@UAEPBGXZ
?Init@FFileManager@@UAEXH@Z
?ReallocContiguous@FMalloc@@UAEPAXPAXKKPBG@Z
??0FString@@QAE@ABV0@@Z
??YFString@@QAEAAV0@PBG@Z
?appStricmp@@YAHPBG0@Z
?Logf@FOutputDevice@@QAAXPBGZZ
??1FRegistryObjectInfo@@QAE@XZ
?Add@FArray@@QAEHHH@Z
?StaticConstructObject@UObject@@SAPAV1@PAVUClass@@PAV1@VFName@@K1PAVFOutputDevice@@1@Z
?GError@@3PAVFOutputDeviceError@@A
?GetTransientPackage@UObject@@SAPAVUPackage@@XZ
?PrivateStaticClass@UCommandlet@@0VUClass@@A
??4FString@@QAEAAV0@ABV0@@Z
??HFString@@QAE?AV0@PBG@Z
??0FString@@QAE@PBG@Z
?appStrchr@@YAPAGPBGH@Z
?winToANSI@@YAPADPADPBGH@Z
?winGetSizeANSI@@YAHPBG@Z
?GUnicodeOS@@3HA
?GetError@FArchive@@UAEHXZ
?Flush@FArchive@@UAEXXZ
?DetachLazyLoader@FArchive@@UAEXPAVFLazyLoader@@@Z
?AttachLazyLoader@FArchive@@UAEXPAVFLazyLoader@@@Z
?SetStopper@FArchive@@UAEXH@Z
?AtStopper@FArchive@@UAEHXZ
?AtEnd@FArchive@@UAEHXZ
?MapObject@FArchive@@UAEHPAVUObject@@@Z
?MapName@FArchive@@UAEHPAVFName@@@Z
??6FArchive@@UAEAAV0@AAVFName@@@Z
??6FArchive@@UAEAAV0@AAPAVUObject@@@Z
?CountBytes@FArchive@@UAEXKK@Z
?Preload@FArchive@@UAEXPAVUObject@@@Z
?SerializeInt@FArchive@@UAEXAAKK@Z
?SerializeBits@FArchive@@UAEXPAXH@Z
??1FArchive@@UAE@XZ
??0FArchive@@QAE@XZ
?appGetSystemErrorMessage@@YAPBGH@Z
?Precache@FArchive@@UAEXH@Z
?TotalSize@FArchive@@UAEHXZ
GIsSSE
?appFromAnsi@@YAPBGPBDPAG@Z
??_7FArchive@@6B@
?Remove@FArray@@QAEXHHH@Z
??1FArray@@QAE@XZ
??DFString@@QBE?AV0@ABV0@@Z
??DFString@@QBE?AV0@PBG@Z
?Realloc@FArray@@IAEXH@Z
?winToUNICODE@@YAPAGPAGPBDH@Z
?winGetSizeUNICODE@@YAHPBD@Z
??0FString@@QAE@XZ
??4FString@@QAEAAV0@PBG@Z
?appStaticString1024@@YAPAGXZ
?appAtoi@@YAHPBG@Z
?appAtof@@YAMPBG@Z
?Log@FOutputDevice@@QAEXPBG@Z
??8FString@@QBEHPBG@Z
?appSaveStringToFile@@YAHABVFString@@PBGPAVFFileManager@@@Z
??YFString@@QAEAAV0@ABV0@@Z
?Printf@FString@@SA?AV1@PBGZZ
??8FString@@QBEHABV0@@Z
?appStrstr@@YAPAGPBG0@Z
?appLoadFileToString@@YAHAAVFString@@PBGPAVFFileManager@@@Z
?appStrcmp@@YAHPBG0@Z
?appExit@@YAXXZ
?appPreExit@@YAXXZ
?GWarn@@3PAVFFeedbackContext@@A
?ParseParms@UObject@@QAEXPBG@Z
?GetFullName@UObject@@QBEPBGPAG@Z
??9FString@@QBEHPBG@Z
?Mid@FString@@QBE?AV1@HH@Z
?InStr@FString@@QBEHPBGH@Z
?Log@FOutputDevice@@QAEXABVFString@@@Z
??HFString@@QAE?AV0@ABV0@@Z
?GetDefaultObject@UClass@@QAEPAVUObject@@XZ
?ParseToken@@YAHAAPBGAAVFString@@H@Z
?StaticLoadClass@UObject@@SAPAVUClass@@PAV2@PAV1@PBG2KPAVUPackageMap@@@Z
?GLazyLoad@@3HA
?GIsServer@@3HA
?GIsScriptable@@3HA
?GIsUCC@@3HA
?GetRegistryObjects@UObject@@SAXAAV?$TArray@VFRegistryObjectInfo@@@@PAVUClass@@1H@Z
?PrivateStaticClass@UClass@@0V1@A
?SetLanguage@UObject@@SAXPBG@Z
?appInit@@YAXPBG0PAVFMalloc@@PAVFOutputDevice@@PAVFOutputDeviceError@@PAVFFeedbackContext@@PAVFFileManager@@P6APAVFConfigCache@@XZH@Z
?GIsStarted@@3HA
kernel32
GetFileSize
CreateFileA
CreateFileW
SetFilePointer
CloseHandle
SetFileAttributesA
SetFileAttributesW
WriteFile
GetLastError
DeleteFileA
DeleteFileW
MoveFileA
MoveFileW
GetFileAttributesExW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
ReadFile
CopyFileA
CopyFileW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
RemoveDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetCommandLineA
GetModuleHandleA
msvcr70
_purecall
wprintf
_CxxThrowException
fflush
_iob
fgets
malloc
free
realloc
_heapchk
calloc
??1type_info@@UAE@XZ
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
_except_handler3
__CxxFrameHandler
Exports
Exports
Sections
.text Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ